esc_url()　WordPress関数　テンプレートタグ

<?php
4259	/**
4260	 * Checks and cleans a URL.
4261	 *
4262	 * A number of characters are removed from the URL. If the URL is for displaying
4263	 * (the default behaviour) ampersands are also replaced. The {@see 'clean_url'} filter
4264	 * is applied to the returned cleaned URL.
4265	 *
4266	 * @since 2.8.0
4267	 *
4268	 * @param string $url       The URL to be cleaned.
4269	 * @param array  $protocols Optional. An array of acceptable protocols.
4270	 *                          Defaults to return value of wp_allowed_protocols()
4271	 * @param string $_context  Private. Use esc_url_raw() for database usage.
4272	 * @return string The cleaned $url after the {@see 'clean_url'} filter is applied.
4273	 */
4274	function esc_url( $url, $protocols = null, $_context = 'display' ) {
4275	        $original_url = $url;
4276	
4277	        if ( '' == $url ) {
4278	                return $url;
4279	        }
4280	
4281	        $url = str_replace( ' ', '%20', ltrim( $url ) );
4282	        $url = preg_replace( '|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url );
4283	
4284	        if ( '' === $url ) {
4285	                return $url;
4286	        }
4287	
4288	        if ( 0 !== stripos( $url, 'mailto:' ) ) {
4289	                $strip = array( '%0d', '%0a', '%0D', '%0A' );
4290	                $url   = _deep_replace( $strip, $url );
4291	        }
4292	
4293	        $url = str_replace( ';//', '://', $url );
4294	        /* If the URL doesn't appear to contain a scheme, we
4295	         * presume it needs http:// prepended (unless a relative
4296	         * link starting with /, # or ? or a php file).
4297	         */
4298	        if ( strpos( $url, ':' ) === false && ! in_array( $url[0], array( '/', '#', '?' ) ) &&
4299	                ! preg_match( '/^[a-z0-9-]+?\.php/i', $url ) ) {
4300	                $url = 'http://' . $url;
4301	        }
4302	
4303	        // Replace ampersands and single quotes only when displaying.
4304	        if ( 'display' == $_context ) {
4305	                $url = wp_kses_normalize_entities( $url );
4306	                $url = str_replace( '&amp;', '&#038;', $url );
4307	                $url = str_replace( "'", '&#039;', $url );
4308	        }
4309	
4310	        if ( ( false !== strpos( $url, '[' ) ) || ( false !== strpos( $url, ']' ) ) ) {
4311	
4312	                $parsed = wp_parse_url( $url );
4313	                $front  = '';
4314	
4315	                if ( isset( $parsed['scheme'] ) ) {
4316	                        $front .= $parsed['scheme'] . '://';
4317	                } elseif ( '/' === $url[0] ) {
4318	                        $front .= '//';
4319	                }
4320	
4321	                if ( isset( $parsed['user'] ) ) {
4322	                        $front .= $parsed['user'];
4323	                }
4324	
4325	                if ( isset( $parsed['pass'] ) ) {
4326	                        $front .= ':' . $parsed['pass'];
4327	                }
4328	
4329	                if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) {
4330	                        $front .= '@';
4331	                }
4332	
4333	                if ( isset( $parsed['host'] ) ) {
4334	                        $front .= $parsed['host'];
4335	                }
4336	
4337	                if ( isset( $parsed['port'] ) ) {
4338	                        $front .= ':' . $parsed['port'];
4339	                }
4340	
4341	                $end_dirty = str_replace( $front, '', $url );
4342	                $end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty );
4343	                $url       = str_replace( $end_dirty, $end_clean, $url );
4344	
4345	        }
4346	
4347	        if ( '/' === $url[0] ) {
4348	                $good_protocol_url = $url;
4349	        } else {
4350	                if ( ! is_array( $protocols ) ) {
4351	                        $protocols = wp_allowed_protocols();
4352	                }
4353	                $good_protocol_url = wp_kses_bad_protocol( $url, $protocols );
4354	                if ( strtolower( $good_protocol_url ) != strtolower( $url ) ) {
4355	                        return '';
4356	                }
4357	        }
4358	
4359	        /**
4360	         * Filters a string cleaned and escaped for output as a URL.
4361	         *
4362	         * @since 2.3.0
4363	         *
4364	         * @param string $good_protocol_url The cleaned URL to be returned.
4365	         * @param string $original_url      The URL prior to cleaning.
4366	         * @param string $_context          If 'display', replace ampersands and single quotes only.
4367	         */
4368	        return apply_filters( 'clean_url', $good_protocol_url, $original_url, $_context );
4369	}
?>